{"id":"GHSA-pwjq-6wrh-5w8q","summary":"Withdrawn Advisory: OnionShare Predictable Pathname","details":"## Withdrawn Advisory\nThis advisory has been withdrawn because the advisory concerns the repository https://github.com/onionshare/onionshare, which is not in a [supported ecosystem](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). [onionshare-cli](https://pypi.org/project/onionshare-cli/) is not affected by this issue.\n\n## Original Description\nThe `debug_mode` function in `web/web.py` in OnionShare through 1.3.1, when `--debug` is enabled, uses the `/tmp/onionshare_server.log` pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.","aliases":["CVE-2018-19960"],"modified":"2026-09-10T03:49:24.149371652Z","published":"2022-05-14T01:36:38Z","withdrawn":"2023-10-09T00:43:44Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-07-24T22:17:36Z","nvd_published_at":"2018-12-07T16:29:00Z","cwe_ids":["CWE-20"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19960"},{"type":"WEB","url":"https://github.com/onionshare/onionshare/issues/837"},{"type":"WEB","url":"https://github.com/onionshare/onionshare/commit/4da5e15581a69509e7bfc6c4d0742052e0b61b24"},{"type":"WEB","url":"https://github.com/onionshare/onionshare/commit/aa5fdde6a4e4de7f113e01a3b446dcc14dcecb1a"},{"type":"WEB","url":"https://bugs.debian.org/915859"},{"type":"PACKAGE","url":"https://github.com/onionshare/onionshare"}],"affected":[{"package":{"name":"onionshare-cli","ecosystem":"PyPI","purl":"pkg:pypi/onionshare-cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pwjq-6wrh-5w8q/GHSA-pwjq-6wrh-5w8q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}